Unusual but valid headers in requests are not available to PHP when running via CGI
Open
Nobody has claimed this yet.
Bug
SAPI: cgi
Status: Needs Triage
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.2k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
The following code:
<?php
print_r($_SERVER);
Requested with:
curl -s -H 'X-Test: 1' -H 'X-%%Test%%: 1' 'http://127.0.0.1/' | grep 'HTTP_'
Resulted in this output:
[HTTP_X_TEST] => 1
[HTTP_ACCEPT] => */*
[HTTP_USER_AGENT] => curl/7.83.1
[HTTP_HOST] => 127.0.0.1
But I expected this output instead:
[HTTP_X_TEST] => 1
[HTTP_X_%%TEST%%] => 1
[HTTP_ACCEPT] => */*
[HTTP_USER_AGENT] => curl/7.83.1
[HTTP_HOST] => 127.0.0.1
This appears to be unique to CGI, or alternatively mod_php is immune.
PHP Version
PHP 8.1.26
Operating System
Alpine Linux 3.18
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the request against PHP 8.1.26 on Alpine Linux 3.18 through CGI and inspect how CGI populates $SERVER, comparing the result with mod_php. Done means the unusual X-%%Test%% header is available as HTTP_X%%TEST%% while existing headers remain available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100